Cisco IOS

VLAN Config Generator

Generate pasteable VLAN, trunk, and inter-VLAN routing configs

What is a VLAN?

A VLAN (Virtual Local Area Network) is a logical segmentation of a physical network at Layer 2. Devices in the same VLAN communicate as if on the same physical switch, regardless of location. Traffic between VLANs requires a Layer 3 device to route between them.

Broadcast domain reduction — limits scope of broadcast traffic, reducing unnecessary load
Security isolation — separates management, voice, and sensitive traffic from user traffic
Flexibility — group users by function, not physical location
Simplified management — move users between segments by reassigning VLAN, not rewiring

VLAN Types

Type	Purpose	Notes
Data	Regular user traffic (PCs, servers)	One per logical group; most common type
Management	SSH, SNMP, syslog, switch admin	Always use a dedicated VLAN — never VLAN 1
Native	Untagged 802.1Q trunk traffic	Default is VLAN 1 — always change to unused VLAN
Voice	IP phone traffic with higher QoS priority	Separate from data for consistent voice quality
Default (VLAN 1)	All ports start here by default	Cannot be deleted or renamed — never use for traffic
Black Hole	Unused VLAN for inactive/unused ports	Security best practice — shut down ports assigned here

802.1Q Tagging

IEEE 802.1Q is the industry standard for VLAN tagging. A 4-byte tag is inserted into the Ethernet frame between the source MAC address and the EtherType field when the frame crosses a trunk link.

TPID

0x8100

Tag Size

4 bytes

PCP (QoS)

3 bits (0–7)

DEI

1 bit

VLAN ID

12 bits

Usable IDs

1 – 4094

Native VLAN: Frames on the native VLAN cross a trunk without a tag. Both ends must agree, or STP issues and VLAN hopping attacks can occur. Always change native from VLAN 1.

VLAN ID Ranges

Range	VLANs	Notes
IEEE Reserved	0, 4095	Cannot be assigned or used
Default VLAN	1	Default for all ports; cannot be deleted or renamed
Normal Range	1 – 1005	Stored in `flash:/vlan.dat`; all VTP modes
Legacy Reserved	1002 – 1005	Token Ring/FDDI; avoid
Extended Range	1006 – 4094	VTP transparent/off required; stored in running-config

802.1Q vs ISL Trunking

Feature	802.1Q	ISL (Legacy)
Standard	IEEE open standard	Cisco proprietary
Encapsulation	4-byte tag inserted in frame	26-byte header + 4-byte trailer wrap
Native VLAN	Supported (untagged)	Not supported
Status	Current standard — always use	Deprecated — avoid
IOS Command	encapsulation dot1q	encapsulation isl

VTP (VLAN Trunking Protocol)

Cisco-proprietary protocol that propagates VLAN database changes between switches. Convenient but dangerous — a single misconfigured switch can wipe all VLANs from your entire network.

Mode	Creates VLANs	Propagates	Stores DB	Recommended
Server	Yes	Yes	flash:/vlan.dat	Use carefully
Client	No	Forwards	RAM only	Access layer
Transparent	Local only	Forwards	running-config	Preferred
Off	Local only	No	running-config	Most secure

VTP Revision Risk: Connecting a switch with a higher revision number overwrites the entire VLAN DB on every switch in the domain instantly. Always reset by running vtp mode transparent then back to vtp mode server before adding any new switch.

VLAN Best Practices

Never use VLAN 1 for user, management, or voice traffic
Change native VLAN to an unused ID on all trunks; prevents VLAN hopping
Always explicitly set switchport trunk allowed vlan — never allow all VLANs implicitly
Hard-set switchport mode access or trunk; disable DTP with switchport nonegotiate
Assign unused ports to a black hole VLAN and issue shutdown
Use VTP transparent or off mode for safe, predictable VLAN management
Document your numbering scheme (e.g., 10=DATA, 20=OPS, 30=VOICE, 40=SECURITY, 99=MANAGEMENT)

Key VLAN Show Commands

Command	Purpose
show vlan brief	VLAN ID, name, status, and assigned access ports
show vlan id <id>	Full detail for a single VLAN
show interfaces trunk	All trunks: encap, native VLAN, allowed/active VLANs
show interfaces <intf> switchport	Full switchport detail: mode, VLANs, DTP state
show mac address-table vlan <id>	MAC table filtered to one VLAN
show vtp status	VTP domain, mode, version, revision number
show vtp counters	VTP advertisements sent/received

VLANs (one per line: id,name)

Trunk Interface

Native VLAN

conf t
!
! === VLAN Creation ===
vlan 10
 name Engineering
!
vlan 20
 name Operations
!
vlan 30
 name Voice
!
vlan 99
 name Management
!
! === Trunk Configuration ===
interface Gi0/1
 description Trunk Port
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,30,99
 switchport nonegotiate
 no shutdown
!
end
copy running-config startup-config